[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71SJEC4DC2E11D4YP7F7YV1":3,"skill-same:01M71SJEC4DC2E11D4YP7F7YV1":67},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":42,"linkOnly":43,"markdownContent":44,"markdownBody":45,"frontMatter":46,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":13,"repositoryHtmlUrl":50,"repositoryHomepageUrl":6,"ownerHtmlUrl":51,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":52,"install":53,"resources":66},"01M71SJEC4DC2E11D4YP7F7YV1","incident-runbook-templates",null,"Create structured incident response runbooks with step-by-step procedures, escalation paths, and recovery actions. Use when building runbooks, responding to incidents, or establishing incident resp...","javiertarazon\u002Fide-agente-free-jt7-","javiertarazon","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153141207?v=4","01M71R52TB3S9HXKH6WSNT8A7V","01M71R52VG5KS2DKDDH4GDQ30A",0,"MIT","https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-\u002Fblob\u002Frelease\u002Fv4.2.11-panel-pro\u002F.github\u002Fskills\u002Fincident-runbook-templates\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41],"incident runbook templates","incident","incident runbook","runbook","templates","structured","with","incidents","incident response","when","community","recovery","use","escalation","paths","create","unknown","runbooks","actions","2026-11-10 13:02:02",false,"---\nname: incident-runbook-templates\ndescription: \"Create structured incident response runbooks with step-by-step procedures, escalation paths, and recovery actions. Use when building runbooks, responding to incidents, or establishing incident resp...\"\nrisk: unknown\nsource: community\n---\n\n# Incident Runbook Templates\n\nProduction-ready templates for incident response runbooks covering detection, triage, mitigation, resolution, and communication.\n\n## Do not use this skill when\n\n- The task is unrelated to incident runbook templates\n- You need a different domain or tool outside this scope\n\n## Instructions\n\n- Clarify goals, constraints, and required inputs.\n- Apply relevant best practices and validate outcomes.\n- Provide actionable steps and verification.\n- If detailed examples are required, open `resources\u002Fimplementation-playbook.md`.\n\n## Use this skill when\n\n- Creating incident response procedures\n- Building service-specific runbooks\n- Establishing escalation paths\n- Documenting recovery procedures\n- Responding to active incidents\n- Onboarding on-call engineers\n\n## Core Concepts\n\n### 1. Incident Severity Levels\n\n| Severity | Impact | Response Time | Example |\n|----------|--------|---------------|---------|\n| **SEV1** | Complete outage, data loss | 15 min | Production down |\n| **SEV2** | Major degradation | 30 min | Critical feature broken |\n| **SEV3** | Minor impact | 2 hours | Non-critical bug |\n| **SEV4** | Minimal impact | Next business day | Cosmetic issue |\n\n### 2. Runbook Structure\n\n```\n1. Overview & Impact\n2. Detection & Alerts\n3. Initial Triage\n4. Mitigation Steps\n5. Root Cause Investigation\n6. Resolution Procedures\n7. Verification & Rollback\n8. Communication Templates\n9. Escalation Matrix\n```\n\n## Runbook Templates\n\n### Template 1: Service Outage Runbook\n\n```markdown\n# [Service Name] Outage Runbook\n\n## Overview\n**Service**: Payment Processing Service\n**Owner**: Platform Team\n**Slack**: #payments-incidents\n**PagerDuty**: payments-oncall\n\n## Impact Assessment\n- [ ] Which customers are affected?\n- [ ] What percentage of traffic is impacted?\n- [ ] Are there financial implications?\n- [ ] What's the blast radius?\n\n## Detection\n### Alerts\n- `payment_error_rate > 5%` (PagerDuty)\n- `payment_latency_p99 > 2s` (Slack)\n- `payment_success_rate \u003C 95%` (PagerDuty)\n\n### Dashboards\n- [Payment Service Dashboard](https:\u002F\u002Fgrafana\u002Fd\u002Fpayments)\n- [Error Tracking](https:\u002F\u002Fsentry.io\u002Fpayments)\n- [Dependency Status](https:\u002F\u002Fstatus.stripe.com)\n\n## Initial Triage (First 5 Minutes)\n\n### 1. Assess Scope\n```bash\n# Check service health\nkubectl get pods -n payments -l app=payment-service\n\n# Check recent deployments\nkubectl rollout history deployment\u002Fpayment-service -n payments\n\n# Check error rates\ncurl -s \"http:\u002F\u002Fprometheus:9090\u002Fapi\u002Fv1\u002Fquery?query=sum(rate(http_requests_total{status=~'5..'}[5m]))\"\n```\n\n### 2. Quick Health Checks\n- [ ] Can you reach the service? `curl -I https:\u002F\u002Fapi.company.com\u002Fpayments\u002Fhealth`\n- [ ] Database connectivity? Check connection pool metrics\n- [ ] External dependencies? Check Stripe, bank API status\n- [ ] Recent changes? Check deploy history\n\n### 3. Initial Classification\n| Symptom | Likely Cause | Go To Section |\n|---------|--------------|---------------|\n| All requests failing | Service down | Section 4.1 |\n| High latency | Database\u002Fdependency | Section 4.2 |\n| Partial failures | Code bug | Section 4.3 |\n| Spike in errors | Traffic surge | Section 4.4 |\n\n## Mitigation Procedures\n\n### 4.1 Service Completely Down\n```bash\n# Step 1: Check pod status\nkubectl get pods -n payments\n\n# Step 2: If pods are crash-looping, check logs\nkubectl logs -n payments -l app=payment-service --tail=100\n\n# Step 3: Check recent deployments\nkubectl rollout history deployment\u002Fpayment-service -n payments\n\n# Step 4: ROLLBACK if recent deploy is suspect\nkubectl rollout undo deployment\u002Fpayment-service -n payments\n\n# Step 5: Scale up if resource constrained\nkubectl scale deployment\u002Fpayment-service -n payments --replicas=10\n\n# Step 6: Verify recovery\nkubectl rollout status deployment\u002Fpayment-service -n payments\n```\n\n### 4.2 High Latency\n```bash\n# Step 1: Check database connections\nkubectl exec -n payments deploy\u002Fpayment-service -- \\\n  curl localhost:8080\u002Fmetrics | grep db_pool\n\n# Step 2: Check slow queries (if DB issue)\npsql -h $DB_HOST -U $DB_USER -c \"\n  SELECT pid, now() - query_start AS duration, query\n  FROM pg_stat_activity\n  WHERE state = 'active' AND duration > interval '5 seconds'\n  ORDER BY duration DESC;\"\n\n# Step 3: Kill long-running queries if needed\npsql -h $DB_HOST -U $DB_USER -c \"SELECT pg_terminate_backend(pid);\"\n\n# Step 4: Check external dependency latency\ncurl -w \"@curl-format.txt\" -o \u002Fdev\u002Fnull -s https:\u002F\u002Fapi.stripe.com\u002Fv1\u002Fhealth\n\n# Step 5: Enable circuit breaker if dependency is slow\nkubectl set env deployment\u002Fpayment-service \\\n  STRIPE_CIRCUIT_BREAKER_ENABLED=true -n payments\n```\n\n### 4.3 Partial Failures (Specific Errors)\n```bash\n# Step 1: Identify error pattern\nkubectl logs -n payments -l app=payment-service --tail=500 | \\\n  grep -i error | sort | uniq -c | sort -rn | head -20\n\n# Step 2: Check error tracking\n# Go to Sentry: https:\u002F\u002Fsentry.io\u002Fpayments\n\n# Step 3: If specific endpoint, enable feature flag to disable\ncurl -X POST https:\u002F\u002Fapi.company.com\u002Finternal\u002Ffeature-flags \\\n  -d '{\"flag\": \"DISABLE_PROBLEMATIC_FEATURE\", \"enabled\": true}'\n\n# Step 4: If data issue, check recent data changes\npsql -h $DB_HOST -c \"\n  SELECT * FROM audit_log\n  WHERE table_name = 'payment_methods'\n  AND created_at > now() - interval '1 hour';\"\n```\n\n### 4.4 Traffic Surge\n```bash\n# Step 1: Check current request rate\nkubectl top pods -n payments\n\n# Step 2: Scale horizontally\nkubectl scale deployment\u002Fpayment-service -n payments --replicas=20\n\n# Step 3: Enable rate limiting\nkubectl set env deployment\u002Fpayment-service \\\n  RATE_LIMIT_ENABLED=true \\\n  RATE_LIMIT_RPS=1000 -n payments\n\n# Step 4: If attack, block suspicious IPs\nkubectl apply -f - \u003C\u003CEOF\napiVersion: networking.k8s.io\u002Fv1\nkind: NetworkPolicy\nmetadata:\n  name: block-suspicious\n  namespace: payments\nspec:\n  podSelector:\n    matchLabels:\n      app: payment-service\n  ingress:\n  - from:\n    - ipBlock:\n        cidr: 0.0.0.0\u002F0\n        except:\n        - 192.168.1.0\u002F24  # Suspicious range\nEOF\n```\n\n## Verification Steps\n```bash\n# Verify service is healthy\ncurl -s https:\u002F\u002Fapi.company.com\u002Fpayments\u002Fhealth | jq\n\n# Verify error rate is back to normal\ncurl -s \"http:\u002F\u002Fprometheus:9090\u002Fapi\u002Fv1\u002Fquery?query=sum(rate(http_requests_total{status=~'5..'}[5m]))\" | jq '.data.result[0].value[1]'\n\n# Verify latency is acceptable\ncurl -s \"http:\u002F\u002Fprometheus:9090\u002Fapi\u002Fv1\u002Fquery?query=histogram_quantile(0.99,sum(rate(http_request_duration_seconds_bucket[5m]))by(le))\" | jq\n\n# Smoke test critical flows\n.\u002Fscripts\u002Fsmoke-test-payments.sh\n```\n\n## Rollback Procedures\n```bash\n# Rollback Kubernetes deployment\nkubectl rollout undo deployment\u002Fpayment-service -n payments\n\n# Rollback database migration (if applicable)\n.\u002Fscripts\u002Fdb-rollback.sh $MIGRATION_VERSION\n\n# Rollback feature flag\ncurl -X POST https:\u002F\u002Fapi.company.com\u002Finternal\u002Ffeature-flags \\\n  -d '{\"flag\": \"NEW_PAYMENT_FLOW\", \"enabled\": false}'\n```\n\n## Escalation Matrix\n\n| Condition | Escalate To | Contact |\n|-----------|-------------|---------|\n| > 15 min unresolved SEV1 | Engineering Manager | @manager (Slack) |\n| Data breach suspected | Security Team | #security-incidents |\n| Financial impact > $10k | Finance + Legal | @finance-oncall |\n| Customer communication needed | Support Lead | @support-lead |\n\n## Communication Templates\n\n### Initial Notification (Internal)\n```\n🚨 INCIDENT: Payment Service Degradation\n\nSeverity: SEV2\nStatus: Investigating\nImpact: ~20% of payment requests failing\nStart Time: [TIME]\nIncident Commander: [NAME]\n\nCurrent Actions:\n- Investigating root cause\n- Scaling up service\n- Monitoring dashboards\n\nUpdates in #payments-incidents\n```\n\n### Status Update\n```\n📊 UPDATE: Payment Service Incident\n\nStatus: Mitigating\nImpact: Reduced to ~5% failure rate\nDuration: 25 minutes\n\nActions Taken:\n- Rolled back deployment v2.3.4 → v2.3.3\n- Scaled service from 5 → 10 replicas\n\nNext Steps:\n- Continuing to monitor\n- Root cause analysis in progress\n\nETA to Resolution: ~15 minutes\n```\n\n### Resolution Notification\n```\n✅ RESOLVED: Payment Service Incident\n\nDuration: 45 minutes\nImpact: ~5,000 affected transactions\nRoot Cause: Memory leak in v2.3.4\n\nResolution:\n- Rolled back to v2.3.3\n- Transactions auto-retried successfully\n\nFollow-up:\n- Postmortem scheduled for [DATE]\n- Bug fix in progress\n```\n```\n\n### Template 2: Database Incident Runbook\n\n```markdown\n# Database Incident Runbook\n\n## Quick Reference\n| Issue | Command |\n|-------|---------|\n| Check connections | `SELECT count(*) FROM pg_stat_activity;` |\n| Kill query | `SELECT pg_terminate_backend(pid);` |\n| Check replication lag | `SELECT extract(epoch from (now() - pg_last_xact_replay_timestamp()));` |\n| Check locks | `SELECT * FROM pg_locks WHERE NOT granted;` |\n\n## Connection Pool Exhaustion\n```sql\n-- Check current connections\nSELECT datname, usename, state, count(*)\nFROM pg_stat_activity\nGROUP BY datname, usename, state\nORDER BY count(*) DESC;\n\n-- Identify long-running connections\nSELECT pid, usename, datname, state, query_start, query\nFROM pg_stat_activity\nWHERE state != 'idle'\nORDER BY query_start;\n\n-- Terminate idle connections\nSELECT pg_terminate_backend(pid)\nFROM pg_stat_activity\nWHERE state = 'idle'\nAND query_start \u003C now() - interval '10 minutes';\n```\n\n## Replication Lag\n```sql\n-- Check lag on replica\nSELECT\n  CASE\n    WHEN pg_last_wal_receive_lsn() = pg_last_wal_replay_lsn() THEN 0\n    ELSE extract(epoch from now() - pg_last_xact_replay_timestamp())\n  END AS lag_seconds;\n\n-- If lag > 60s, consider:\n-- 1. Check network between primary\u002Freplica\n-- 2. Check replica disk I\u002FO\n-- 3. Consider failover if unrecoverable\n```\n\n## Disk Space Critical\n```bash\n# Check disk usage\ndf -h \u002Fvar\u002Flib\u002Fpostgresql\u002Fdata\n\n# Find large tables\npsql -c \"SELECT relname, pg_size_pretty(pg_total_relation_size(relid))\nFROM pg_catalog.pg_statio_user_tables\nORDER BY pg_total_relation_size(relid) DESC\nLIMIT 10;\"\n\n# VACUUM to reclaim space\npsql -c \"VACUUM FULL large_table;\"\n\n# If emergency, delete old data or expand disk\n```\n```\n\n## Best Practices\n\n### Do's\n- **Keep runbooks updated** - Review after every incident\n- **Test runbooks regularly** - Game days, chaos engineering\n- **Include rollback steps** - Always have an escape hatch\n- **Document assumptions** - What must be true for steps to work\n- **Link to dashboards** - Quick access during stress\n\n### Don'ts\n- **Don't assume knowledge** - Write for 3 AM brain\n- **Don't skip verification** - Confirm each step worked\n- **Don't forget communication** - Keep stakeholders informed\n- **Don't work alone** - Escalate early\n- **Don't skip postmortems** - Learn from every incident\n\n## Resources\n\n- [Google SRE Book - Incident Management](https:\u002F\u002Fsre.google\u002Fsre-book\u002Fmanaging-incidents\u002F)\n- [PagerDuty Incident Response](https:\u002F\u002Fresponse.pagerduty.com\u002F)\n- [Atlassian Incident Management](https:\u002F\u002Fwww.atlassian.com\u002Fincident-management)\n","# Incident Runbook Templates\n\nProduction-ready templates for incident response runbooks covering detection, triage, mitigation, resolution, and communication.\n\n## Do not use this skill when\n\n- The task is unrelated to incident runbook templates\n- You need a different domain or tool outside this scope\n\n## Instructions\n\n- Clarify goals, constraints, and required inputs.\n- Apply relevant best practices and validate outcomes.\n- Provide actionable steps and verification.\n- If detailed examples are required, open `resources\u002Fimplementation-playbook.md`.\n\n## Use this skill when\n\n- Creating incident response procedures\n- Building service-specific runbooks\n- Establishing escalation paths\n- Documenting recovery procedures\n- Responding to active incidents\n- Onboarding on-call engineers\n\n## Core Concepts\n\n### 1. Incident Severity Levels\n\n| Severity | Impact | Response Time | Example |\n|----------|--------|---------------|---------|\n| **SEV1** | Complete outage, data loss | 15 min | Production down |\n| **SEV2** | Major degradation | 30 min | Critical feature broken |\n| **SEV3** | Minor impact | 2 hours | Non-critical bug |\n| **SEV4** | Minimal impact | Next business day | Cosmetic issue |\n\n### 2. Runbook Structure\n\n```\n1. Overview & Impact\n2. Detection & Alerts\n3. Initial Triage\n4. Mitigation Steps\n5. Root Cause Investigation\n6. Resolution Procedures\n7. Verification & Rollback\n8. Communication Templates\n9. Escalation Matrix\n```\n\n## Runbook Templates\n\n### Template 1: Service Outage Runbook\n\n```markdown\n# [Service Name] Outage Runbook\n\n## Overview\n**Service**: Payment Processing Service\n**Owner**: Platform Team\n**Slack**: #payments-incidents\n**PagerDuty**: payments-oncall\n\n## Impact Assessment\n- [ ] Which customers are affected?\n- [ ] What percentage of traffic is impacted?\n- [ ] Are there financial implications?\n- [ ] What's the blast radius?\n\n## Detection\n### Alerts\n- `payment_error_rate > 5%` (PagerDuty)\n- `payment_latency_p99 > 2s` (Slack)\n- `payment_success_rate \u003C 95%` (PagerDuty)\n\n### Dashboards\n- [Payment Service Dashboard](https:\u002F\u002Fgrafana\u002Fd\u002Fpayments)\n- [Error Tracking](https:\u002F\u002Fsentry.io\u002Fpayments)\n- [Dependency Status](https:\u002F\u002Fstatus.stripe.com)\n\n## Initial Triage (First 5 Minutes)\n\n### 1. Assess Scope\n```bash\n# Check service health\nkubectl get pods -n payments -l app=payment-service\n\n# Check recent deployments\nkubectl rollout history deployment\u002Fpayment-service -n payments\n\n# Check error rates\ncurl -s \"http:\u002F\u002Fprometheus:9090\u002Fapi\u002Fv1\u002Fquery?query=sum(rate(http_requests_total{status=~'5..'}[5m]))\"\n```\n\n### 2. Quick Health Checks\n- [ ] Can you reach the service? `curl -I https:\u002F\u002Fapi.company.com\u002Fpayments\u002Fhealth`\n- [ ] Database connectivity? Check connection pool metrics\n- [ ] External dependencies? Check Stripe, bank API status\n- [ ] Recent changes? Check deploy history\n\n### 3. Initial Classification\n| Symptom | Likely Cause | Go To Section |\n|---------|--------------|---------------|\n| All requests failing | Service down | Section 4.1 |\n| High latency | Database\u002Fdependency | Section 4.2 |\n| Partial failures | Code bug | Section 4.3 |\n| Spike in errors | Traffic surge | Section 4.4 |\n\n## Mitigation Procedures\n\n### 4.1 Service Completely Down\n```bash\n# Step 1: Check pod status\nkubectl get pods -n payments\n\n# Step 2: If pods are crash-looping, check logs\nkubectl logs -n payments -l app=payment-service --tail=100\n\n# Step 3: Check recent deployments\nkubectl rollout history deployment\u002Fpayment-service -n payments\n\n# Step 4: ROLLBACK if recent deploy is suspect\nkubectl rollout undo deployment\u002Fpayment-service -n payments\n\n# Step 5: Scale up if resource constrained\nkubectl scale deployment\u002Fpayment-service -n payments --replicas=10\n\n# Step 6: Verify recovery\nkubectl rollout status deployment\u002Fpayment-service -n payments\n```\n\n### 4.2 High Latency\n```bash\n# Step 1: Check database connections\nkubectl exec -n payments deploy\u002Fpayment-service -- \\\n  curl localhost:8080\u002Fmetrics | grep db_pool\n\n# Step 2: Check slow queries (if DB issue)\npsql -h $DB_HOST -U $DB_USER -c \"\n  SELECT pid, now() - query_start AS duration, query\n  FROM pg_stat_activity\n  WHERE state = 'active' AND duration > interval '5 seconds'\n  ORDER BY duration DESC;\"\n\n# Step 3: Kill long-running queries if needed\npsql -h $DB_HOST -U $DB_USER -c \"SELECT pg_terminate_backend(pid);\"\n\n# Step 4: Check external dependency latency\ncurl -w \"@curl-format.txt\" -o \u002Fdev\u002Fnull -s https:\u002F\u002Fapi.stripe.com\u002Fv1\u002Fhealth\n\n# Step 5: Enable circuit breaker if dependency is slow\nkubectl set env deployment\u002Fpayment-service \\\n  STRIPE_CIRCUIT_BREAKER_ENABLED=true -n payments\n```\n\n### 4.3 Partial Failures (Specific Errors)\n```bash\n# Step 1: Identify error pattern\nkubectl logs -n payments -l app=payment-service --tail=500 | \\\n  grep -i error | sort | uniq -c | sort -rn | head -20\n\n# Step 2: Check error tracking\n# Go to Sentry: https:\u002F\u002Fsentry.io\u002Fpayments\n\n# Step 3: If specific endpoint, enable feature flag to disable\ncurl -X POST https:\u002F\u002Fapi.company.com\u002Finternal\u002Ffeature-flags \\\n  -d '{\"flag\": \"DISABLE_PROBLEMATIC_FEATURE\", \"enabled\": true}'\n\n# Step 4: If data issue, check recent data changes\npsql -h $DB_HOST -c \"\n  SELECT * FROM audit_log\n  WHERE table_name = 'payment_methods'\n  AND created_at > now() - interval '1 hour';\"\n```\n\n### 4.4 Traffic Surge\n```bash\n# Step 1: Check current request rate\nkubectl top pods -n payments\n\n# Step 2: Scale horizontally\nkubectl scale deployment\u002Fpayment-service -n payments --replicas=20\n\n# Step 3: Enable rate limiting\nkubectl set env deployment\u002Fpayment-service \\\n  RATE_LIMIT_ENABLED=true \\\n  RATE_LIMIT_RPS=1000 -n payments\n\n# Step 4: If attack, block suspicious IPs\nkubectl apply -f - \u003C\u003CEOF\napiVersion: networking.k8s.io\u002Fv1\nkind: NetworkPolicy\nmetadata:\n  name: block-suspicious\n  namespace: payments\nspec:\n  podSelector:\n    matchLabels:\n      app: payment-service\n  ingress:\n  - from:\n    - ipBlock:\n        cidr: 0.0.0.0\u002F0\n        except:\n        - 192.168.1.0\u002F24  # Suspicious range\nEOF\n```\n\n## Verification Steps\n```bash\n# Verify service is healthy\ncurl -s https:\u002F\u002Fapi.company.com\u002Fpayments\u002Fhealth | jq\n\n# Verify error rate is back to normal\ncurl -s \"http:\u002F\u002Fprometheus:9090\u002Fapi\u002Fv1\u002Fquery?query=sum(rate(http_requests_total{status=~'5..'}[5m]))\" | jq '.data.result[0].value[1]'\n\n# Verify latency is acceptable\ncurl -s \"http:\u002F\u002Fprometheus:9090\u002Fapi\u002Fv1\u002Fquery?query=histogram_quantile(0.99,sum(rate(http_request_duration_seconds_bucket[5m]))by(le))\" | jq\n\n# Smoke test critical flows\n.\u002Fscripts\u002Fsmoke-test-payments.sh\n```\n\n## Rollback Procedures\n```bash\n# Rollback Kubernetes deployment\nkubectl rollout undo deployment\u002Fpayment-service -n payments\n\n# Rollback database migration (if applicable)\n.\u002Fscripts\u002Fdb-rollback.sh $MIGRATION_VERSION\n\n# Rollback feature flag\ncurl -X POST https:\u002F\u002Fapi.company.com\u002Finternal\u002Ffeature-flags \\\n  -d '{\"flag\": \"NEW_PAYMENT_FLOW\", \"enabled\": false}'\n```\n\n## Escalation Matrix\n\n| Condition | Escalate To | Contact |\n|-----------|-------------|---------|\n| > 15 min unresolved SEV1 | Engineering Manager | @manager (Slack) |\n| Data breach suspected | Security Team | #security-incidents |\n| Financial impact > $10k | Finance + Legal | @finance-oncall |\n| Customer communication needed | Support Lead | @support-lead |\n\n## Communication Templates\n\n### Initial Notification (Internal)\n```\n🚨 INCIDENT: Payment Service Degradation\n\nSeverity: SEV2\nStatus: Investigating\nImpact: ~20% of payment requests failing\nStart Time: [TIME]\nIncident Commander: [NAME]\n\nCurrent Actions:\n- Investigating root cause\n- Scaling up service\n- Monitoring dashboards\n\nUpdates in #payments-incidents\n```\n\n### Status Update\n```\n📊 UPDATE: Payment Service Incident\n\nStatus: Mitigating\nImpact: Reduced to ~5% failure rate\nDuration: 25 minutes\n\nActions Taken:\n- Rolled back deployment v2.3.4 → v2.3.3\n- Scaled service from 5 → 10 replicas\n\nNext Steps:\n- Continuing to monitor\n- Root cause analysis in progress\n\nETA to Resolution: ~15 minutes\n```\n\n### Resolution Notification\n```\n✅ RESOLVED: Payment Service Incident\n\nDuration: 45 minutes\nImpact: ~5,000 affected transactions\nRoot Cause: Memory leak in v2.3.4\n\nResolution:\n- Rolled back to v2.3.3\n- Transactions auto-retried successfully\n\nFollow-up:\n- Postmortem scheduled for [DATE]\n- Bug fix in progress\n```\n```\n\n### Template 2: Database Incident Runbook\n\n```markdown\n# Database Incident Runbook\n\n## Quick Reference\n| Issue | Command |\n|-------|---------|\n| Check connections | `SELECT count(*) FROM pg_stat_activity;` |\n| Kill query | `SELECT pg_terminate_backend(pid);` |\n| Check replication lag | `SELECT extract(epoch from (now() - pg_last_xact_replay_timestamp()));` |\n| Check locks | `SELECT * FROM pg_locks WHERE NOT granted;` |\n\n## Connection Pool Exhaustion\n```sql\n-- Check current connections\nSELECT datname, usename, state, count(*)\nFROM pg_stat_activity\nGROUP BY datname, usename, state\nORDER BY count(*) DESC;\n\n-- Identify long-running connections\nSELECT pid, usename, datname, state, query_start, query\nFROM pg_stat_activity\nWHERE state != 'idle'\nORDER BY query_start;\n\n-- Terminate idle connections\nSELECT pg_terminate_backend(pid)\nFROM pg_stat_activity\nWHERE state = 'idle'\nAND query_start \u003C now() - interval '10 minutes';\n```\n\n## Replication Lag\n```sql\n-- Check lag on replica\nSELECT\n  CASE\n    WHEN pg_last_wal_receive_lsn() = pg_last_wal_replay_lsn() THEN 0\n    ELSE extract(epoch from now() - pg_last_xact_replay_timestamp())\n  END AS lag_seconds;\n\n-- If lag > 60s, consider:\n-- 1. Check network between primary\u002Freplica\n-- 2. Check replica disk I\u002FO\n-- 3. Consider failover if unrecoverable\n```\n\n## Disk Space Critical\n```bash\n# Check disk usage\ndf -h \u002Fvar\u002Flib\u002Fpostgresql\u002Fdata\n\n# Find large tables\npsql -c \"SELECT relname, pg_size_pretty(pg_total_relation_size(relid))\nFROM pg_catalog.pg_statio_user_tables\nORDER BY pg_total_relation_size(relid) DESC\nLIMIT 10;\"\n\n# VACUUM to reclaim space\npsql -c \"VACUUM FULL large_table;\"\n\n# If emergency, delete old data or expand disk\n```\n```\n\n## Best Practices\n\n### Do's\n- **Keep runbooks updated** - Review after every incident\n- **Test runbooks regularly** - Game days, chaos engineering\n- **Include rollback steps** - Always have an escape hatch\n- **Document assumptions** - What must be true for steps to work\n- **Link to dashboards** - Quick access during stress\n\n### Don'ts\n- **Don't assume knowledge** - Write for 3 AM brain\n- **Don't skip verification** - Confirm each step worked\n- **Don't forget communication** - Keep stakeholders informed\n- **Don't work alone** - Escalate early\n- **Don't skip postmortems** - Learn from every incident\n\n## Resources\n\n- [Google SRE Book - Incident Management](https:\u002F\u002Fsre.google\u002Fsre-book\u002Fmanaging-incidents\u002F)\n- [PagerDuty Incident Response](https:\u002F\u002Fresponse.pagerduty.com\u002F)\n- [Atlassian Incident Management](https:\u002F\u002Fwww.atlassian.com\u002Fincident-management)\n",{"name":5,"risk":39,"source":33,"description":7},"release\u002Fv4.2.11-panel-pro","a92ea02bcf7e2b3dbaf46d49696c29a3cb490d4f",".github\u002Fskills\u002Fincident-runbook-templates","https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-","https:\u002F\u002Fgithub.com\u002Fjaviertarazon","2026-07-12 07:10:45",{"source":8,"skillName":5,"commands":54,"prompt":64,"zipAvailable":65},[55,58,61],{"tool":56,"command":57},"npx","npx skills add javiertarazon\u002Fide-agente-free-jt7- --skill incident-runbook-templates",{"tool":59,"command":60},"bunx","bunx skills add javiertarazon\u002Fide-agente-free-jt7- --skill incident-runbook-templates",{"tool":62,"command":63},"pnpm","pnpm dlx skills add javiertarazon\u002Fide-agente-free-jt7- --skill incident-runbook-templates","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-\u002Fblob\u002Frelease\u002Fv4.2.11-panel-pro\u002F.github\u002Fskills\u002Fincident-runbook-templates\u002FSKILL.md",true,[],[68,92,119,139,154,176],{"skillNo":69,"name":70,"nameZh":6,"description":71,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":72,"categories":73,"keywords":77,"publishedAt":42},"01M71TQ7Q6Z10VWF3C2H5X1KW9","zustand-store-ts","Create Zustand stores with TypeScript, subscribeWithSelector middleware, and proper state\u002Faction separation. Use when building React state management, creating global stores, or implementing reacti...","https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-\u002Fblob\u002Frelease\u002Fv4.2.11-panel-pro\u002F.github\u002Fskills\u002Fzustand-store-ts\u002FSKILL.md",[74],{"categoryNo":75,"categoryName":76,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000009","前端开发",[78,79,80,33,81,82,35,83,32,39,84,29,85,38,86,87,88,89,90,91],"zustand","store","zustand store ts","middleware","implementing","react state management","react","state","state management","typescript","action","management","separation","global",{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":101,"publishedAt":42},"01M71TQ5EAR40G6W0MV5ZDVEZT","zoom-automation","Automate Zoom meeting creation, management, recordings, webinars, and participant tracking via Rube MCP (Composio). Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-\u002Fblob\u002Frelease\u002Fv4.2.11-panel-pro\u002F.github\u002Fskills\u002Fzoom-automation\u002FSKILL.md",[98],{"categoryNo":99,"categoryName":100,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",[102,103,104,33,105,106,107,108,109,39,110,111,112,113,114,115,116,117,89,118],"zoom automation","zoom","automation","creation","for","search","schemas","MCP","first","via","meeting","search tools","tracking","webinars","composio","recordings","Tools",{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":126,"publishedAt":42},"01M71TQ29B1EYBCEAP1ZBGXQ1A","zoho-crm-automation","Automate Zoho CRM tasks via Rube MCP (Composio): create\u002Fupdate records, search contacts, manage leads, and convert leads. Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-\u002Fblob\u002Frelease\u002Fv4.2.11-panel-pro\u002F.github\u002Fskills\u002Fzoho-crm-automation\u002FSKILL.md",[125],{"categoryNo":99,"categoryName":100,"taxonomyType":20,"taxonomyTypeDesc":21},[127,128,104,129,130,131,33,132,133,106,134,107,108,135,109,39,136,137,138,38],"crm automation","zoho crm automation","crm","zoho crm","zoho","leads","manage leads","manage","records","convert","tasks","contacts",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":146,"publishedAt":42},"01M71TPZPMN60DH0XV58KVHY23","zendesk-automation","Automate Zendesk tasks via Rube MCP (Composio): tickets, users, organizations, replies. Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-\u002Fblob\u002Frelease\u002Fv4.2.11-panel-pro\u002F.github\u002Fskills\u002Fzendesk-automation\u002FSKILL.md",[145],{"categoryNo":99,"categoryName":100,"taxonomyType":20,"taxonomyTypeDesc":21},[147,104,148,33,106,107,108,109,149,39,137,150,151,110,111,152,113,116,118,153],"zendesk automation","zendesk","organizations","replies","users","tickets","automate",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":160,"publishedAt":42},"01M71TPXDWKHKG4N6TVEPXWD0N","zapier-make-patterns","No-code automation democratizes workflow building. Zapier and Make (formerly Integromat) let non-developers automate business processes without writing code. But no-code doesn't mean no-complexity ...","https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-\u002Fblob\u002Frelease\u002Fv4.2.11-panel-pro\u002F.github\u002Fskills\u002Fzapier-make-patterns\u002FSKILL.md",[],[161,162,163,164,165,166,167,168,169,104,170,39,171,172,173,174,175,153],"zapier make patterns","zapier","patterns","make","No-Code","complexity","writing","spawner","business","workflow","code","integromat","apache","processes","but",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":185,"publishedAt":42},"01M71TPT5T10WXNKW9G7ZXZ27W","youtube-summarizer","Extract transcripts from YouTube videos and generate comprehensive, detailed summaries using intelligent analysis frameworks","https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-\u002Fblob\u002Frelease\u002Fv4.2.11-panel-pro\u002F.github\u002Fskills\u002Fyoutube-summarizer\u002FSKILL.md",[182],{"categoryNo":183,"categoryName":184,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000016","图像与多媒体",[186,187,188,189,33,190,191,192,193,194,195,196,171,197,198,199,200,201,202,203],"summarizer","youtube","youtube summarizer","Video","content-analysis","frameworks","copilot","2025","github-copilot","extract transcripts","analysis","codex","cli","summaries","github","generate","summarization","2026"]